Method and system for monitoring point of sale exceptions

ABSTRACT

A method and system for monitoring point of sale exceptions includes the ability to proactively and automatically analyze POS transactional data for certain patterns or occurrences that typically indicate specific behavior at or near a POS terminal in connection with a sales related operation, retrieve time-correlated video segments of a specified length of time from a camera source associated with the POS terminal used to execute aforementioned transaction, and present the video and transaction data together without obstruction on the same user display for contemporaneous review.

BACKGROUND OF THE INVENTION

1. Field of the Invention

Aspects of the present invention concern a platform to integrate datafrom multiple systems including, but not limited to, POS, video, EAS,alarm systems. etc. Some embodiments of the present invention relate todigital video recording and surveillance systems. More specifically,some embodiments of this invention relate to automated correlation ofvideo data from digital recording video recording and surveillancesystems with asynchronous transactions data from one-to-many discreteinputs.

2. Discussion of the Related Art

In the retail environment, certain types or patterns of employee orcustomer behavior at the register can be closely associated with fraud,theft or insufficient training. In addition, customer behavior at theresister is invaluable data for merchandizing and marketing. These typesof behavior generally result in a monetary loss by the owner of theretail business. Analyzing point of sale (POS) data and searching forquestionable behavior is gaining popularity among large retailorganizations but is typically not practiced by less sophisticatedorganizations. Many organizations outsource this analysis and refer toit as “Data Mining” or “Exception Reporting”. In-house or third partysystems presently in place are somewhat cumbersome and inefficient. Theprocess of collecting the data from a multitude of geographicallydiverse locations, analyzing the data according to rigid guidelines,producing a written report, and distributing the written report can takeseveral days and be very expensive. Further, the distributed ExceptionReports are not tied to video data captured by surveillance systems inthe store, as will be discussed in greater detail below.

For example, the use of surveillance systems to record cash transactionsfor later review well known in the art. For example, in U.S. Pat. No.4,337,482 issued to Coutta, can be understood to disclose a surveillancesystem that monitors and records transactions that occur at a number ofcashier lanes. In Coutta, a single television camera, mounted on a rail,can be positioned to make a video recording of the transactions thatoccur at a single selected cashier lane. Coutta discloses that thedigital transaction data from the cash register in the selected cashierlane is fed into a video character generator to provide a compositevideo picture in which an alphanumeric display of the transaction dataoverlays the video image of the transaction. Since a composite videoimage is generated with respect to only one cashier lane, it is usuallypossible to position the camera so that the alphanumeric overlay doesnot obscure a useful portion of the recorded video image. However, if asingle camera is used to simultaneously record transactions occurring ata plurality of cashier lanes, it is likely that the alphanumeric overlaydata will obscure important parts of the video image of at least one ofthe cashier lanes. This likelihood is further increased when a largenumber of parameters are displayed simultaneously for all of the cashierlanes.

U.S. Pat. No. 4,630,110, issued to Cotton et al., suggests asurveillance system that monitors and records a single lane using aplurality of video cameras. In one embodiment, the video image from fourcameras may be combined wherein two of the cameras are focused on cashregisters. Cotton et al. discloses that textual data can be displayed atthe lower portion of the combined video picture.

Another surveillance system disclosed in U.S. Pat. No. 4,145,715, toClever, is understood to generate two levels of surveillance records.The first level, generated by a tape recorder, contains a record of alltransactions. The second level generated on the tape recorder containsonly selected transactions. In Clever, transaction data such as theprice and department number are input to a character generator. Thecharacter generator output is mixed with the video image to create acomposite video frame. This composite video frame consists ofalphanumeric transaction data which overlays the transaction videoimage. This composite video frame is then recorded by the video taperecorder onto video tape.

Although Clever discloses that a single camera can be used to scanseveral point-of-sale (POS) stations, the generated video image containsalphanumeric transaction data that is permanently overlaid on the videoimage. This is because the composite video frame is generated beforerecording on video tape. This overlay can degrade the clarity of theresultant video images if the transaction data is placed over the videoimage corresponding to a particular cashier lane. Alternatively, aportion of the video may be blacked out so that the transaction data canbe more easily read when viewed at a later time on the monitor. In thisinstance, the blacked out portion is recorded over a portion of theimage being recorded by the television camera. In this situation, theportion of the video image which was blacked out is lost forever.

As the devices that perform data entry (cash registers, data terminals,optical character readers, radio frequency readers, magnetic mediareaders, and many other like input devices. etc.) become moresophisticated, larger quantities of alphanumeric characters describingthe transaction are generated. The clarity of the video image of atransaction is particularly important when the transaction lanes areoutdoors and are recorded under varying light and weather conditions.The increase in information tends to clutter and obscure the compositevideo image. As the number of lanes being recorded increases, it becomesmore difficult to overlay all of the alphanumeric transaction data atpositions that will not obscure important parts of the video transactionimage.

As suggested by Katz in U.S. Pat. No. 5,216,502, transaction data andvideo pictures associated with the transaction data are recordedseparately and synchronously on media capable of storing a full motionvideo.

The references described above all require that the transaction data beavailable at the time that the behavior is being recorded. However,there are certain applications where this technology cannot be applied,for example, in situations where the point-of-sale system buffers thetransaction data until the termination of the transaction, or at thetermination of several transactions, or when an event is associatedafter the transaction has occurred. At the end of the transaction, thedata is transmitted from the terminal to the host. Accordingly, thetransaction information cannot be recorded synchronously with the videopictures of the transaction.

SUMMARY OF THE INVENTION

Accordingly, the present invention is directed to a method and systemfor monitoring point of sale exceptions that substantially obviates oneor more of the problems due to limitations and disadvantages of therelated art.

Some embodiments of the present invention provide improved surveillancesystem and security practices. Some embodiments of the present inventionfurther provide extended utility and access to video data for uses otherthan security such as related to merchandising and marketing, researchof products, transactional environment, customer service effects. etc.

It should be further appreciated that some embodiments of the presentinvention provide the ability to proactively and automatically analyzeevent transactional data for certain patterns or occurrences thattypically indicate specific behavior at or near a POS terminal inconnection with a sales related operation, retrieve time-correlatedvideo segments of specified lengths of time from a camera sourceassociated with the POS terminal used to execute aforementionedtransaction, and presents the video and transaction data togetherwithout obstruction on the same user display for contemporaneous reviewin a proactive manner determined by system definitions.

Additional features and advantages of the invention will be set forth inthe description which follows, and in part will be apparent from thedescription, or may be learned by practice of the invention. Theobjectives and other advantages of the invention will be realized andattained by the structure particularly pointed out in the writtendescription and claims hereof as well as the appended drawings.

To achieve these and other advantages and in accordance with the purposeof the present invention, as embodied and broadly described, a methodfor detecting fraud in a transactional environment includes—capturingvideo data of behavioral events corresponding to a predeterminedtransaction, storing the generated video data in a first predeterminedstorage medium, generating data corresponding to the predeterminedtransaction, storing the generated data in a predetermined storagemedium, determining event occurrences within the generated data, andproactively generating user-defined exception when a number of eventswithin the generated data exceeds a predetermined threshold number ofevents. The user-defined exception includes selected time-synchronizeddata with respect to the determined event occurrences and thecorresponding video.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and areintended to provide further explanation of the invention as claimed.

BRIEF DESCRIPTION OF THE DRAWING

The accompanying drawings, which are included to provide a furtherunderstanding of the invention and are incorporated in and constitute apart of this specification, illustrate embodiments of the invention andtogether with the description serve to explain the principles of theinvention.

In the drawings:

FIG. 1 is a schematic block diagram illustrating a configuration for POSrelated functions according to one embodiment of the present invention;

FIG. 2 is a schematic block diagram of the user interface portion of thesoftware machine referenced in FIG. 3;

FIG. 3 is a schematic block diagram that identifies the variouscomponents comprising the software machine referenced in FIG. 1 and FIG.6;

FIG. 4 is a schematic block diagram of the POS interface portion of thesoftware machine referenced in FIG. 3;

FIG. 5 is a schematic block diagram of the DVR interface portion of thesoftware machine referenced in FIG. 3;

FIG. 6 is a schematic block diagram illustrating another configurationrelating to alternative input systems according to another embodiment ofthe present invention;

FIG. 7 is a schematic block diagram of the time synchronization portionof the software machine referenced in FIG. 3 according to one aspect ofthe present invention;

FIG. 8 illustrates a schematic block diagram of the exception managerportion of the software machine referenced in FIG. 3, and itsrelationship between the POS interface and the notification engine alsoreferenced in FIG. 3;

FIG. 9 is a schematic block diagram of the notification engine portionof the software machine referenced in FIG. 3;

FIG. 10 illustrates an exception notification according to one aspect ofthe present invention;

FIG. 11 is a schematic block diagram of the setup and maintenanceportion of the software machine referenced in FIG. 3; and

FIG. 12 is a schematic block diagram of the storage and archival portionof the software machine referenced in FIG. 3.

DETAILED DESCRIPTION OF THE ILLUSTRATED EMBODIMENTS

Reference will now be made in detail to an embodiment of the presentinvention, example of which is illustrated in the accompanying drawings.

The present invention integrates legacy systems (e.g., POS terminals,CCTV video surveillance systems, EAS, fire alarms, etc.) fromtransactional environments and correlates information outputs from eachof the legacy systems in a pro-active and meaningful way. Synergisticresults stemming from the aforementioned integration include the abilityto identify repetition of patterns of certain events that are indicativeof fraud, theft, or inadequate training, and that warrant furtherinvestigation. Non-inclusive exemplary transactional environmentsinclude grocery stores, convenience stores, mass merchandise stores,specialty stores, music stores, home improvement stores, pawn shops, andother related markets. Typical targets for video surveillance camerasinclude check out lanes, building entry and exit points, shoppingaisles, customer services desks, specialty departments, etc. Someembodiments of the present invention combine video and data in thetransactional environment.

The method and medium by which manufacturers of cash register and otherPOS terminals format, transmit, and store transactional data isextremely diverse. As described above, some POS terminals immediatelytransmit the transaction data to their POS host/controller immediatelyafter every item is scanned or entered. Other POS terminals hold orbuffer the information in an internal memory until a certain time oruntil a buffer reaches a time or space threshold before transmitting thetransaction data to the POS host/controller. POS terminals typicallyassemble and use data in a proprietary structure and format. Beingcapable of reading the data generated from one POS terminal does notensure the ability to read data from another POS terminal. The presentinvention incorporates a flexible design accommodating opencompatibility with a plurality of POS terminals and operationalmethodologies.

FIG. 1 illustrates a schematic block diagram of a configuration for POSrelated functions according to one embodiment of the present invention.

Sales related transactions within Point-of-Sales (POS) systems aregenerally executed using a POS terminal 3. Transactional data indicativeof the sales related transactions is stored in an internal memory (notshown) of the POS terminal 3 before it is transmitted to the POShost/controller 4. Transmission of the transactional data may be eithera batch process or a real-time process. The POS host/controller 4 thenstores the transactional data in POS transmission database (POS TX DB) 5for future use.

Video cameras 9 (e.g., CCTV surveillance cameras, etc.), in one aspectof the invention, may generally include a plurality of video cameraspointed at various targets within the retail environment and provide acentral vantage point of viewing elements within a transactionalenvironment (e.g., employees, registers, doors, consumers, merchandise,etc.). Conventionally, analog video signals generated by video camerasare received by a multiplexing device and are further recorded onmagnetic tape using a Video Cassette Recorder (VCR). In accordance withone aspect of the present invention, analog video signals generated bythe video cameras 9 are received by analog to digital conversiontechnology for recording digital video data on digital media (e.g.,magnetic hard drive, etc.) using a digital video recorder 6. A digitalversion of the video generated by the video camera in the video securitysystem 9 is stored in a video database 7. In accordance with analternate aspect of the present invention, digital video signalsgenerated by the video cameras 9 may be received directly into thedigital video recorder.

Transaction data from the POS TX DB 5 and digital video images from thevideo database 7 are integrated and made useable together via a computer1 (e.g., a standard personal computer, IBM, Macintosh, etc.) supportinga software machine 2. The software machine 2 manages network connections(e.g., TCP/IP via Ethernet LAN topology, etc.) with the POShost/controller 4 and the digital video recorder to acquire the POStransactional data and digital video data, respectively. The softwaremachine 2 allows users to access the system of the present invention forconfiguration and operation via web-based software running on a userdisplay 8. In one aspect of the present invention, the software machine2 has the capability to support either a single or many user displaysvia local network connection (e.g., TCP/IP via Ethernet LAN topology) orremote network connection (e.g., TCP/TP Internet, Intranet, Extranet,VPN or Dial connection.)

FIG. 2 illustrates a schematic block diagram of a user interface portion2.1 of the software machine 2, as will be further referenced in FIG. 3,and its relationship with the user display(s). The user interface 2.1may be provided, for example, as a web browser client running on thecomputer 1 connected to the user display 8 of the present invention viaappropriate network connections (e.g., local or remote).

Referring now to FIG. 3, a schematic block diagram is illustratedidentifying the various components of the software machine 2.

The software machine may be constructed as a web application running inhost mode that includes a user interface 2.1, a setup and administrationmodule 2.2, a POS interface 2.3, a digital video recorder (DVR)interface 2.4, storage and archival engine 2.5, an exception manager2.6, an alternate input manager 2.7, and a notification engine 2.8.

With reference to FIG. 4, the POS interface 2.3 of the software machine2 will now be discussed in greater detail.

The POS interface 2.3 within the software machine 2 may be generallytreated as a switched virtual connection (SVC) that operates as abackground service running on the computer 1 and includes a POS processmanager 2.3A that oversees the operations of the POS interface portionof the software machine 2, a POS connector 2.3B that acts as the primarymeans of acquiring transactional data from the POS TX DB 5 by managing anetwork connection with the POS host/controller 4, a data dictionary2.3C that converts relevant transactional data into a common format, anda common transaction database 2.3D for storing the relevant transactiondata.

More specifically, as directed by the POS process manager 2.3A, the POSconnector 2.3B acquires transactional data from the POS TX DB 5 via oneof three methods: 1) accessing a transaction log file on the POShost/controller 4; 2) establishing a direct connection with the POS TXDB 5 via POS host/controller 4; or 3) establishing a socket levelconnection with the POS host/controller 4 via a predetermined Internetprotocol. The POS connector 2.3B may locally or remotely interface withthe POS system (i.e., the POS terminal(s) 3; the POS host/controller 4,and the POS TX DB 5) via the POS host/controller 4 according toprogrammed time intervals or as directed by a user to acquire data fromthe POS system. In response to a query from the POS connector 2.3B, thePOS host/controller 4 broadcasts transactional data within the POSsystem over the socket to a receiving program managed by the POSconnector 2.3B. Data formats of disparate POS terminals are typicallydifferent from one another. Accordingly, once the transactional data isacquired from a particular POS system, the raw transactional data iswritten to a local file (not shown) on the computer 1 and is processedthrough a data dictionary 2.3C where it is converted into a commonformat (e.g., XML) useable by process modules within the softwaremachine 2, as will be described in greater detail below. The datadictionary 2.3C is essentially a conversion reference that maps POStransaction data from one format to another. To accomplish this formattranslation, a unique map is constructed for each disparate data format.These unique maps are initiated and maintained via the setup andadministration module 2.2 through the user interface 2.1, as will bediscussed in greater detail with reference to FIG. 8. Once conversion tothe common format is complete, the integrity of the commonly formatted(e.g., XML) transaction data is validated and checked for errors. Thecommonly formatted transaction data is then qualified againstprogrammable criteria, specified via the user interface, to determinethe whether the data corresponds to an event. The qualified transactiondata is then written to a common format POS transaction database 2.3D,located in the storage and archival portion 2.5 of the software machine2, for future use by an exception manager 2.6 portion of the softwaremachine, as will be discussed in greater detail below.

With reference to FIG. 5, the DVR interface 2.4 of the software machine2 will now be discussed in greater detail.

Products that convert analog video signals to digital media are widelyavailable. Digital video recording technology offers many advantagesover conventional recording methods. Digital Video Recorder (DVR)systems may include computers equipped with specialized encodingequipment to produce and store digital video segments. As digital videosignals are produced and stored within digital recording media (e.g.,hard disk, etc.), corresponding timestamp information is also stored ina separate reference database. Additionally, correlated sourceinformation is stored with the timestamp information so that users ofthe system in the present invention can determine which video segmentwas generated by which video camera.

The present invention incorporates a flexible design accommodating opencompatibility with pre-existing disparate DVR systems and operationalmethodologies. The DVR interface portion 2.4 of the software machine 2generally includes a DVR process manager 2.4A, operating in a similarfashion as the POS process manager 2.3A in the POS interface 2.3, whichoversees the operations of the DVR interface, a DVR connector 2.4B thatacts as the primary means of acquiring digital video data from the videodatabase 7 by managing a network connection with the DVR 6, and anoptimized video database 2.4C for storing predetermined time segments ofdigital video, as will be discussed in greater detail below.

More specifically, as directed by the DVR process manager 2.4A, the DVRconnector 2.4B manages a network connection (e.g., TCP/IP via EthernetLAN topology) with the DVR 6 to acquire the predetermined time slices ofdigital video from the video database 7 via one of two methods: 1)establishing a direct connection to the database and file systems of theDVR 6; or 2) establishing programmatic requests to a softwareapplication running on the DVR 6. The DVR connector 2.4B maintainsconfiguration files corresponding to either of the aforementioned videodata acquisition methods and facilitates the interface and digital videodata acquisition. According to the principles of the present invention,only a small subset of the video data stored on the DVR systems at anygiven time. Video segments of predetermined length from a specificcamera source are pulled from the video database 7 and stored in theoptimized video database 2.4C, located in the storage and archivalportion 2.5 (See FIG. 3) of the software machine 2, for future use bythe exception manager portion 2.6 and alternative input manager portion2.7, as will be discussed in greater detail below.

Referring to another embodiment the present invention illustrated inFIG. 6 alternative input systems may provide supplemental inputs withinthe transactional environment.

Specifically, the present embodiment recognizes, and makes useable, themany other types of electronic systems other than POS systems that existwithin the retail environment. The alternative input systems generallyinclude sensor inputs which provide state information back to a centralcontrol system (e.g., the software machine 2 running on the computer 1)and are capable of generating a programmed output. These control systemsare generally equipped with means of wired or wireless communicationsand they are capable of visual or auditory enumeration and usually haveprogrammable relay outputs. An exemplary list of these alternative inputsystems include burglar and fire alarm systems, electronic articlesurveillance (EAS) systems, access control (AC) systems, telemetrysystems, and the like. Accordingly, the software machine 2 may manage anetwork connection (e.g., Universal Serial Bus (USB), etc.) via analternative input interface device 10 equipped with a plurality ofprogrammable sensor inputs. Each of the plurality of programmable sensorinputs are, in turn, connected to relay outputs of the aforementionedalternative input systems 11, 12, 13, 14, . . . , n.

The software machine 2 manages configuration data for each of the sensorinputs via the user interface 2.1. Further action by the softwaremachine 2 in regards to state changes of the sensor inputs onalternative input interface device 10 is managed via the alternate inputmanager portion 2.7 of the software machine shown in FIG. 3, as will bediscussed in greater detail below.

Referring now to FIG. 7, a schematic block diagram of the timesynchronization manager is illustrated.

One aspect generally realized by the principles of the present inventionincludes the capability to integrate disparate systems typicallyoperating by their own time sources. For example, POS host/controller 4,DVR 6, and the alternative input interface device 10 components within atransactional environment typically operate according to their owninternally provided time source. The present invention provides theability to accurately relate any required time signatures of a selectedtime segment of digital video with a time signature of a POStransactional event and/or state change event. In some cases, the act ofrelating of the time signatures further occurs after the POStransactional and/or state change event transpires. Accordingly, thepresent invention uses an offset approach to correlate time signaturesof disparate systems within a transactional environment.

Specifically, and as described with reference to FIG. 6, the timesynchronization manager 15 located on the computer 1 records a timesignature from the POS host/controller 4 as well as from the DVR 6 andalternative input interface device 10 (not shown). The timesynchronization manager 15 then records the time signatures from eachsystem, along with a corresponding offset time from its own internaltime source in the offset time database 16. Accordingly, a baseline timestamp maintained within the offset time database can be used tocorrelate the disparate systems within the transactional environment. Inan exemplary aspect of the present invention, an offset time entry maybe recorded every one minute, wherein a temporal resolution down to thesecond is available. Using the aforementioned offset timesynchronization manager, any requirement for time correlated video andPOS transaction data and/or alternative input data may be fulfilledwithin a reasonable degree of accuracy. The time source within the timesynchronization manager 15 may be set, for example, by requesting theofficial time from the Naval Observatory via dial up or Internetconnection on periodic intervals established by the users of the systemvia the user interface 2.1.

In an alternate aspect of the present invention, the synchronization oftime signatures from the various aforementioned components within thetransactional environment (e.g., POS host/controller 4, DVR 6, computer1, alternative input interface device 10) may alternatively becorrelated without the use of a time synchronization manager 15 or anoffset time database 16. Accordingly, in this alternative aspect of thepresent invention, correlation of time signatures from disparate systemsmay be accomplished by appreciating the fact that all of the components,including the computer 1, within the transactional environment exceptfor the POS host/controller may be provided to operate according to whatis known in the art as Simple Network Time Protocol (SNTP). In order tocorrelate the time signature between the aforementioned components andthe POS host/controller 4, a socket connection between the computer 1and the POS host/controller 4 is established where the time signature ofthe POS host/controller 4 is broadcast to the computer 1. The computer1, operating with a time source based on SNTP, then uses the broadcastedtime signature as a basis for setting its own time source and, in turn,broadcasts the time signature of the POS host/controller 4 to theremaining components within the transactional environment so that theremaining components may then alter their time signatures to correspondto the POS host/controller time signature. Thus, regardless of the timeor type of POS host/controller communicating with the software machine 2on the computer 1, the time signature from the POS host/controllerdetermines the time signatures of the components within thetransactional environment. Accordingly, the need for a specialized timedatabase or external verification of standard times is removed, allowingfor a robust ability to synchronize the time signatures of disparatecomponents within a transactional environment.

Referring now to FIG. 8, a block diagram of the logic components withinthe exception manager portion 2.6 of the software machine 2 and itsrelationship with the POS interface portion 2.3 of the software machineincluding common format POS transaction database 2.3D are illustrated.

Conceptually, the exception manager 2.6 includes a plurality of coreprocess modules including an event process module, a trigger processmodule, and an exception process module.

As used in the present disclosure an “event” is characterized accordingto an event definition. An event definition describes a particularbehavior or occurrence that meets specific, user defined criteriacreated and maintained via the user interface 2.1. In one aspect of theinvention, events may be data related to POS transactions (e.g., amanual override at register, a transaction void, a hand-keyed creditcard, hand keyed gift card, price check scan, check over amount, noreceipt return, multiple line scan items, etc.). Event definitions maybe stored in an event definition database provided within the setup andadministration portion 2.2 of the software machine 2, as will bediscussed in greater detail below.

To determine what portions of the transaction data within the commonformat POS transaction database 2.3D correspond to any “event”, a posttransaction procedure 2.6B is used. The post transaction procedure isactivated by a process transaction queue SVC 2.6A that runs as abackground service on the computer 1, within the event process module ofthe exception manager 2.6. The process transaction queue SVC 2.6A runsaccording to programmed time intervals or as directed by a user. Thepost transaction processor parses the commonly formatted transactiondata, posts POS event types found within the commonly formattedtransaction data, and chronologically organizes the occurrence of eventsaccording to values of a predetermined temporal structure (e.g., month,day, year, hour, minute, second, shift schedules, etc. or combinationsthereof). In one aspect of the present invention, the post transactionprocedure 2.6B writes the parsed, posted, and organized data to atransaction history database 2.6C, located within the storage andarchival portion 2.5 of the software machine, for future analysis. Inanother aspect of the present invention, the post transaction procedurewrites POS events from the parsed, posted, and organized data asdiscrete events to a POS event log table 2.6D for subsequent analysis bythe trigger process module, as will be discussed in greater detailbelow. Entries in the POS event log table 2.6D include key identifyinginformation about the transaction or situation in which the eventoccurred. For example, identifying information pertaining to a POS eventmay include an event descriptor, transaction number, date/time stamp,operator ID, terminal ID, sale amount, tender type, and/or tenderamount. Upon encountering a change in the value of the predeterminedtemporal structure within the commonly formatted transaction data, thepost transaction procedure 2.6B initiates a period processing by callinga post period close queue procedure 2.6E. The post period close queueprocedure 2.6E writes transaction data for open periods, which need tobe processed, to a period close table 2.6F. Subsequently, a period closequeue SVC 2.6G, running as a background service on the computer 1,according to either a programmable time interval or as directed by auser, calls a process period close procedure 2.6H. The process periodclose procedure is a stored procedure that generates entries for periodprocessing into a trigger queue table 2.6I, within the trigger processmodule, as will be discussed in greater detail below.

As used in the present disclosure, the term “trigger” is characterizedas a set of user defined parameters related to an event. Each triggermay be further characterized by a definition created and maintained bythe user through the user interface 2.1. Each trigger definition mayinclude components relating to period, group-by parameters, prioritybased on criticality of event, and/or quantity-threshold. As describedabove, a purpose of the present invention is directed to identifyabnormal repetition or patterns of certain events that are indicative offraud, theft, or inadequate training and that warrant investigation.Accordingly, a trigger definition may include user definable boundariesrelating to events indicative of fraud, theft, etc., such as a thresholdfor a predetermined number of events occurring within a predeterminedtemporal period (e.g., a day). Other user-definable boundaries may beset in the trigger definition to achieve granular results of patternanalysis. For example, triggers for a POS related event may be definedas follows: all returns with a tender amount over $200 or more than 12occurrences of a transaction void by the same operator within a 24 hourperiod. In the first example above, the threshold was “all” and the POSevent was “tender amount over $200”. In the second example above thethreshold was “12” and the POS event was “transaction void” furtherqualified by “the same operator”. Trigger definitions may be stored in atrigger definition database provided within the setup and administrationportion 2.2 of the software machine 2, as will be discussed in greaterdetail below.

In the present invention, each trigger entry (provided by the user viathe user interface 2.1) within the trigger queue table 2.6I may beprocessed against the entries within the event log table 2.6D. Toaccomplish this, a process trigger queue SVC 2.6J, running as abackground service on the computer 1, calls a process trigger procedure2.6K either according to predetermined time intervals or as directed bya user. The process trigger procedure then processes entries within thetrigger queue table 2.6I against entries within the event log table. Foreach instance where criteria within a particular trigger definition issatisfied, a corresponding record is written to a trigger history table2.6L, located within the storage and archival portion 2.5 of thesoftware machine, for future analysis. When the trigger thresholds areexceeded, events corresponding to the exceeded thresholds are written toan exception queue table 2.6M for further processing within theexception process module, as will be discussed in greater detail below.

As used in the present disclosure, an event is an “exception” whencriteria within a trigger definition has been met or exceeded. The term“exception” is used herein to refer to a database record containingreferences to the one or many events that satisfy a correspondingtrigger definition. A process exception queue SVC 2.6N, running as abackground service on the computer 1, calls a process exceptionprocedure 2.6O and makes exception entries into a notification queuetable 2.8A according to predetermined time intervals or as directed by auser. Additionally, the process exception procedure makes entries ofexceptions into the exception log table 2.6P, located within the storageand archival portion 2.5 of the software machine, for archival referenceand into an image queue table (not shown). Entries made into the imagequeue table may then be processed according to one or more instructionsset forth within parameters defined by an exception definition (e.g.,video pull instructions and notification instructions). Further,exception definitions may be specified by the user via the userinterface 2.1.

Video pull instructions direct the DVR connector 2.4B to pull apredetermined time segment of video from the video database 7 for eachevent referenced by the exception where it is then stored in anoptimized video database 2.4C, thereby allowing users to associate avideo with transaction activity. For example, wavelet technology may beused to achieve high compression ratios to maximize media storage space.Wavelet compressed data may be converted to an optimized streamingformat which automatically adjusts a data transmission throughput basedon a network connection speed. Web-optimized thumbnails and streamingMPEG-4 video may be alternatively used to replace wavelet technology andoptimize bandwidth over the local or remote network.

Still referring to FIG. 8, notification instructions direct the processnotify queue SVC 2.8B, running as a background service on the computer 1and according to programmable intervals or as otherwise directed by auser, to process entries from the notify queue table 2.8A. Further,according to the notification instructions, the process notify queue SVC2.8B notifies users that an exception has been detected by makingentries in an inbox table 2.8C and/or sending email notification via astandard SMTP service. Notification instructions may direct the deliveryof exception notifications to individuals or groups of individuals basedon components of the trigger definitions. Notification instructions maybe provided within a notification setup module within the setup andadministration portion 2.2 of the software machine 2, as will bediscussed in greater detail below. The results of this entire processare delivered to the user proactively (not requiring a manual query).

More specifically, notification instructions are processed within thenotification engine 2.8 of the software machine 2. FIG. 9 illustrates adetailed schematic block diagram of the notification engine.Notification of exceptions may be provided through many methods. Forexample, notification may be provided visually through the userinterface 2.1 (e.g., a small “mail” icon may flash in a prominent spoton the user interface indicating a new exception available for viewing),may be sent electronically via an external delivery mechanism (e.g., anSMTP message 2.8D, email) to predetermined users of the system, or maybe sent to a Personal Digital Assistant (PDA) 2.8E through a standardwired or wireless interface. The contents of such notifications mayincorporate a means to link an external user back to the system if aproper network connection is made available.

As shown in FIG. 10, an “exception” may be viewed on a browser interfaceand contain information on an employee involved in the event, the typeof event itself, the date, time, location the event took place, anexception reference ID, and appropriate links to view video imagescorrelated with the event in the exception.

According to another embodiment, an “event” may additionally includedata related to state changes input from the alternative input interfacedevice 10. In one aspect of the present invention, the events may bedata related to state changes in the alternative input devices 11, 12,13, etc. (e.g., contact closure on a relay because a fire or a burglarwas detected, etc.).

Accordingly, and in a similar fashion as described above with respect toPOS “events”, upon generation of state change events, a state changeprocessor writes information pertaining to the state change informationto a state change log table (not shown) for subsequent analysis by thetrigger process module. Entries in the state log table include keyidentifying information about the state change or situation in which theevent occurred. For example, identifying information pertaining to statechange events may include the type of alternative input device ID,date/time stamp, location ID, etc.

FIG. 11 illustrates a schematic block diagram of the setup andadministration portion 2.2 of the software machine referenced in FIG. 3.

The system and method of the present invention requires the setup andadministration of many parameters for proper configuration andoperation. These parameters are stored in database tables and/orconfiguration files 16 on a local or remote storage media (e.g., a harddrive) supporting the monitoring system. Access to configuration filesis achieved via a standard operating system user interface while accessto the database tables is achieved via user interface 2.1. Thecollection of database tables and configuration files used to storesetup and operating parameters include user manager and security module2.2A, event definition database 2.2B, trigger definition database 2.2C,POS setup module 2.2D, DVR setup module 2.2E, notification setup 2.2F,and storage and archival module setup 2.2E, all herein genericallyreferred to as “application data”.

The user manager and security module 2.2A is designed to scale bothhorizontally and vertically to accommodate distinct chains of accessauthority within the transactional environment. In one aspect of thepresent invention, the user manager and security module is provided asan application using 128 bit encryption via SSL. Users may beauthenticated at a login stage and may be required to enter three itemsof identification including, for example, store ID, user ID, andpassword. Security within the application may be administered viapermission assignments to users and groups.

FIG. 12 illustrates a schematic block diagram of the storage andarchival portion 2.5 of the software machine 2 referenced in FIG. 3.

In one aspect of the present invention the ability to store and archivePOS application data, DVR, and exception data and other types ofapplication systems data, either online or offline, is provided.Accordingly, access may be provided by the user interface 2.1 to onlineor offline archive and storage databases. Online or offline access toPOS data, DVR data, exception data, and application data is managedthrough an archival process manager 18 and an archive reference module17 that communicates with the user interface 2.1.

Accordingly, the principles of the present invention may providefunctions to prevent losses within a retail environment, as alreadydiscussed in detail above. However, the principles of the presentinvention are instantly translatable as tools toward merchandising andmarketing research of products, transactional environment, customerservice effects, etc. In one aspect of the present invention, existingvideo surveillance systems may be directed toward consumersparticipating in a transactional event. Accordingly, the aforementionedPOS transactional data may be coupled to video of actual consumers atthe point of sale to provide marketing research tools. Such a marketingresearch tool would enable businesses to define their target audiencesfor specific products using extremely accurate and reliable data,thereby eliminating the need for time consuming surveys or test groups.

According to the principles of the present invention, exception analysisof point-of-sale transactional data may be combined with recordeddigital video. Accordingly, the present invention has the capability tooptimize the amount of time spent by loss prevention managers andsecurity officers to pinpoint fraud within a transactional environment.

It will be apparent to those skilled in the art that variousmodifications and variation can be made in the present invention withoutdeparting from the spirit or scope of the invention. Thus, it isintended that the present invention cover the modifications andvariations of this invention provided they come within the scope of theappended claims and their equivalents.

1. A method for detecting fraud in a transactional environment,comprising: capturing video data of behavioral events corresponding to apredetermined transaction; storing the captured video data in a firstpredetermined storage medium; generating data corresponding to thepredetermined transaction; storing the generated data in a secondpredetermined storage medium; determining event occurrences within thegenerated data; and proactively generating a user-defined exception whena number of events within the generated data exceeds a predeterminedthreshold number of events, the user-defined exception comprising:selected time-synchronized data within the generated data with respectto the determined event occurrences; and a portion of the stored videosignals corresponding to a predetermined amount of time corresponding tothe determined event occurrences.
 2. A method of managing events in atransactional environment, said method comprising the following steps:interfacing a plurality of electronic systems to a central computerizedplatform, said plurality of electronic systems including at least onepoint-of-sale (POS) system for providing transaction data indicative ofsales in the transactional environment, and at least one video recordingsystem for providing video signals generated within one or more retaillocations associated with the transactional environment; receiving andinterfacing at least one datastream from each of the plurality ofelectronic systems to yield a collection of assembled data, saidassembled data including transaction data from said at least one POSsystem and video data from said at least one video recording system;synchronizing time signatures associated with each of the plurality ofelectronic systems, whereby all datastreams received from the pluralityof electronic systems are formulated relative to a single timereference; sorting and organizing the transaction data from theplurality of electronic systems to formulate a collection of discreteevents; comparing the events formulated in said step of sorting andorganizing to one or more predetermined event definitions; pro-activelyidentifying as transaction exceptions when the events formulated in saidstep of sorting and organizing meet or exceed the one or morepredetermined event definitions provided in said comparing step;correlating video data having the same time signatures as selected ofthe transaction exceptions with the transaction data corresponding tothe selected of the transaction exceptions; and providing notificationto a user of the identified transaction exceptions.
 3. The method ofmanaging events in a transactional environment as in claim 2, whereinsaid notification to a user comprises both transaction data and videodata associated with said selected of the transaction exceptions.
 4. Themethod of managing events in a transactional environment as in claim 2,wherein said step of sorting and organizing the transaction datacomprises parsing commonly formatted data collected from the pluralityof electronic systems, posting events identified within the commonlyformatted data to an associated storage medium, and chronologicallyorganizing the occurrence of events according to values of apredetermined temporal structure.
 5. The method of managing events in atransactional environment as in claim 2, wherein the one or morepredetermined event definitions of said comparing step are created andmaintained by a user via an accessible user interface.
 6. The method ofmanaging events in a transactional environment as in claim 2, whereinsaid method is performed via web-based software provided on one or moreremote computer systems.
 7. The method of managing events in atransactional environment as in claim 2, wherein said step of providingnotification to a user comprises providing notification information to auser via a visual user display.
 8. The method of managing events in atransactional environment as in claim 2, wherein said step of providingnotification to a user comprises providing an electronic message via anexternal message delivery system.
 9. The method of managing events in atransactional environment as in claim 2, wherein said step of providingnotification to a user comprises relaying notification information to aPersonal Digital Assistant (PDA).
 10. The method of managing events in atransactional environment as in claim 2, further comprising a step ofstoring the transaction data and correlated video date corresponding toselected of the identified transaction exceptions in an associatedstorage medium.
 11. A method of detecting and managing data events froma plurality of electronic systems, said method comprising the followingsteps: coupling each of a plurality of electronic systems to a centralcontrol system; receiving and interfacing at least one datastream fromeach of the plurality of electronic systems to yield a collection ofassembled data; sorting and organizing the assembled data from theplurality of electronic systems to formulate a collection of discreteevents, wherein the discrete events are independent from the assembleddata and are relayed to a dedicated storage medium; comparing the eventsformulated in said step of sorting and organizing to one or morepredetermined event definitions; pro-actively identifying as exceptionswhen the events formulated in said step of sorting and organizing meetor exceed the one or more predetermined event definitions provided insaid comparing step; correlating supplemental time-synchronized data toselected of the identified exceptions; and providing notification to auser of the identified exceptions.
 12. The method of detecting andmanaging data events as in claim 11, further comprising a step ofsynchronizing time signatures associated with each of the plurality ofelectronic systems, whereby any different respective time sources onwhich each of the plurality of electronic systems operates is integratedas a single time reference.
 13. The method of detecting and managingdata events as in claim 11, wherein said step of sorting and organizingthe assembled data comprises parsing commonly formatted data collectedfrom the plurality of electronic systems, posting events identifiedwithin the commonly formatted data to an associated storage medium, andchronologically organizing the occurrence of events according to valuesof a predetermined temporal structure.
 14. The method of detecting andmanaging events as in claim 11, wherein the one or more predeterminedevent definitions of said comparing step are created and maintained by auser via an accessible user interface.
 15. The method of detecting andmanaging events as in claim 11, wherein each of said plurality ofelectronic devices includes one of a point of sale (POS) system, a videorecording system, a burglar/alarm system, an electronic articlesurveillance system, an access control system, or a telemetry system.16. The method of detecting and managing events as in claim 11, whereinsaid method is performed via web-based software provided on one or moreremote computer systems.
 17. The method of detecting and managing eventsas in claim 11, wherein said step of providing notification to a usercomprises providing notification information to a user via a visual userdisplay.
 18. The method of detecting and managing events as in claim 11,wherein said step of providing notification to a user comprisesproviding an electronic message via an external message delivery system.19. The method of detecting and managing events as in claim 11, whereinsaid step of providing notification to a user comprises relayingnotification information to a Personal Digital Assistant (PDA).
 20. Acomputer-based platform for integrating a plurality of electronicsystems and correlating information outputs therefrom, saidcomputer-based platform comprising: at least one interface module forestablishing a connection between the computer-based platform andselected of the plurality of electronic systems and for obtaining datafrom said selected of the plurality of electronic systems; a userinterface for creating and maintaining user-defined criteria forcharacterizing the data from said plurality of electronic systems andfor defining one or more event type associated with the data receivedfrom said plurality of electronic systems; a data-processing procedurefor transforming the data from said plurality of electronic systems intoa common format, parsing the commonly formatted data collected from saidplurality of electronic systems, and posting independent data eventsidentified within the commonly formatted data to an associated storagemedium; an exception manager for determining when events identified viathe data-processing procedure meet or exceed a trigger definition, thuscorresponding to an exception; and a notification engine for proactivelyrelaying notification information regarding selected events andexceptions to a user.
 21. The computer-based platform of claim 20,wherein each of said plurality of electronic devices includes one of apoint of sale (POS) system, a video recording system, a burglar/alarmsystem, an electronic article surveillance system, an access controlsystem, or a telemetry system.
 22. The computer-based platform of claim20, wherein said computer-based platform runs on one or more userdisplays.
 23. The computer-based platform of claim 22, wherein thecomputer-based platform runs on multiple user displays connected via alocal network connection.
 24. The computer-based platform of claim 22,wherein the computer-based platform runs on multiple user displaysconnected via a remote network connection.
 25. The computer-basedplatform of claim 24, wherein the remote network connection is a TCP/IPInternet connection.
 26. The computer-based platform of claim 20,wherein said data processing procedure is further configured tochronologically organize the occurrence of events according to values ofa predetermined temporal structure.
 27. The computer-based platform ofclaim 20, further comprising a setup and administration interface forproviding secure access to and configuration ability of operationalparameters associated with the computer-based platform.
 28. Thecomputer-based platform of claim 20, wherein the notificationinformation relayed via said notification engine is provided via avisual user interface.
 29. The computer-based platform of claim 20,wherein the notification information relayed via said notificationengine is provided electronically via an external message deliverysystem.
 30. The computer-based platform of claim 20, wherein thenotification information relayed via said notification engine isprovided to a Personal Digital Assistant (PDA).
 31. The computer-basedplatform of claim 20, wherein said computer-based platform isimplemented in a transactional environment, wherein said at least oneinterface module comprises a point-of-sale (POS) interface for couplingtransaction data indicative of sales in the transactional environment,and wherein said computer-based platform further comprises a videorecording interface for digitally coupling video signals generatedwithin a retail location associated with the transactional environment.